Accounts lock after managing users through control panel

Question

I have an account lockout issue that is reproducible and exists across many devices.
These systems are Win 7 Professional 32-bit, not domain members, and fairly locked down via local Group Policy - I suspect the issue is in there, but I can't identify it. There are normally two administrator
accounts (this might be important - see below) and one or more unprivileged user accounts.
To reproduce the issue, I log in to one of the admin accounts, create or delete a standard user through Control Panel>User Accounts, and then log off. Immediately both admin accounts are locked out.
I can log in as the standard user I just created, but have to unlock the admin accounts by booting to DVD. The event log shows the admin account log off, followed immediately by 3 credential validation failures for the other admin account
- that is, the account that was not logged in when the user management was performed. I can't imagine where these cred validation failures are coming from, but per Local Group Policy, 3 failures should indeed lock the account. Logs show
no reason at all (AFAIK) for the first admin account - the one actually doing the user management - to be locked.
If I add or remove users through compmgmt.msc, there are no issues of any kind.
As I said, I can reliably reproduce this issue on multiple machines. Any thoughts?

Answer 1

I've just come across this same issue on a Windows 2008 Server.  When entering the User Accounts control panel, a failed logon event is immediately triggered (from dllhost.exe, logon type 2, status code of "bad password") targeting the current user
account.  When clicking the "Manage another account" link, a similar failed logon event is triggered for every account that is listed on that screen.  If this screen is opened multiple times, it's possible to lock out every account on the system.
It's not clear to me why the User Accounts control panel would be attempting to authenticate as any of these accounts, but in the short term, we'll probably use a GPO to prevent access to this particular control panel.  Any administration of local accounts
should be done via MMC consoles anyway.
Not sure if Home Edition desktop operating systems have the same option, or if the same behavior occurs there.